coinebase-pro-wlet[.]webflow[.]io

Analysis of coinebase-pro-wlet.webflow.io shows the domain was created on 21 February 2026 and registered through NameCheap, Inc. The site is delivered via Cloudflare (AS13335) and supports HTTP/3, resolving to the IP address 104.18.36.248, which is geolocated to the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming that traffic is encrypted but offering no assurance of legitimacy. An HTTP request returns a 404 status code and the page title "404 – Page not found," indicating that any malicious content that may have existed has been removed or the hosting has been taken offline. Google Safe Browsing flags the domain for social‑engineering, and VirusTotal reports that 16 of 93 scanning engines have identified the host as malicious, reinforcing the suspicion of abuse.

The Gridinsoft trust score is 0 / 100, and the domain appears on a single security blocklist while being actively blocked by PhishDestroy. The intelligence classifies the threat as a "Brand Impersonation" scam type, though the specific victim brand is not disclosed. Current monitoring status lists the domain as offline. Defenders should continue to block the domain at DNS resolvers and perimeter firewalls and should add the IP 104.18.36.248 to any deny lists used for suspicious Cloudflare edge nodes.

Because the underlying infrastructure is shared with many legitimate services, security teams should also monitor for new sub‑domains on webflow.io that exhibit similar registration patterns or are flagged by Google Safe Browsing. Historical request logs should be examined for any connections to this address prior to its takedown, and, where possible, archived snapshots from web‑archive services can be retrieved to aid forensic analysis. Ongoing vigilance is advised until the domain is fully retired and any related infrastructure is confirmed inactive.